The Events Made Easy WordPress plugin before version 3.1.4 fails to verify that a requester is authorized to modify a targeted person record when processing an unauthenticated data‑change request. This vulnerability is a type of IDOR, classified as CWE‑639, because it allows an attacker to change sensitive data without possession of proper authorization. The only protection is a public nonce that provides no per‑record token or ownership validation, allowing attackers to overwrite the personal data of any person record. This flaw enables alteration of confidentiality and integrity of user information, potentially leading to identity‑tarnishing, data manipulation, and trust erosion for site visitors.

Any WordPress site running the Events Made Easy plugin on a version earlier than 3.1.4 is affected. No specific sub‑versions are listed; all releases before 3.1.4 lack the necessary authorization checks.

The vulnerability can be exploited by sending an unauthenticated HTTP request, including the public nonce and a target record ID, to the plugin’s data‑change endpoint. The attacker can enumerate or guess record IDs, as the plugin does not enforce any record‑level access control. The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, but the absence of authentication checks implies a high severity from a data‑privacy standpoint. Sites that rely on the affected plugin without additional access restrictions face a significant risk of data tampering.